Back to Home
Security

Security

Last Updated: December 2025

SharpShield - Enterprise AI Risk Management Version: 1.0 Effective Date: December 1, 2025 Last Updated: December 31, 2025

Executive Summary

SharpShield maintains a comprehensive security program designed to protect customer data and ensure service availability. Our security framework is built on industry best practices and compliance standards including SOC 2 Type II and ISO 27001.

This document outlines our security controls, policies, and practices.

1. Security Governance

1.1 Security Organization

Security Team Responsibilities:

1.2 Security Policies

We maintain comprehensive security policies including:

Policies are reviewed annually and updated as needed.

1.3 Risk Management

Our risk management program includes:

2. Infrastructure Security

2.1 Cloud Infrastructure

Provider: Amazon Web Services (AWS) Regions: AWS Security Features Utilized:

2.2 Network Security

Architecture: 
        ┌─────────────────┐
        │   CloudFlare    │
        │  (DDoS/WAF/CDN) │
        └────────┬────────┘
                 │
        ┌────────▼────────┐
        │    AWS WAF      │
        │   (Layer 7)     │
        └────────┬────────┘
                 │
        ┌────────▼────────┐
        │  Load Balancer  │
        │   (TLS Term)    │
        └────────┬────────┘
                 │
    ┌────────────┼────────────┐
    │            │            │
┌───▼───┐   ┌────▼────┐   ┌───▼───┐
│  App  │   │   App   │   │  App  │
│ Tier  │   │  Tier   │   │ Tier  │
└───┬───┘   └────┬────┘   └───┬───┘
    │            │            │
    └────────────┼────────────┘
                 │
        ┌────────▼────────┐
        │    Database     │
        │   (Isolated)    │
        └─────────────────┘
Network Controls:

2.3 DDoS Protection

Multiple layers of protection:
LayerProtectionProvider
L3/L4Volumetric attack mitigationAWS Shield Standard
L7Application layer attacksAWS WAF + CloudFlare
DNSDNS amplificationCloudFlare
Capabilities:

3. Application Security

3.1 Secure Development

Secure Development Lifecycle (SDL):
  1. Design: Security requirements, threat modeling
  2. Development: Secure coding standards, peer review
  3. Testing: SAST, DAST, security testing
  4. Deployment: Security gates, automated scanning
  5. Monitoring: Runtime protection, vulnerability tracking
Secure Coding Practices:

3.2 Code Security

Static Analysis (SAST): Dynamic Analysis (DAST): Dependency Scanning:

3.3 API Security

Authentication: Authorization: Input Validation: Rate Limiting:
PlanRequests/MinuteRequests/Day
Growth1,000100,000
Professional5,000500,000
EnterpriseCustomCustom

3.4 Web Application Firewall

Rules enabled:

4. Data Security

4.1 Data Classification

ClassificationDescriptionExamples
PublicInformation intended for public releaseMarketing materials, public docs
InternalBusiness information, not sensitiveInternal procedures, general reports
ConfidentialSensitive business dataCustomer data, financial data
RestrictedHighly sensitive dataCredentials, encryption keys

4.2 Encryption

Encryption at Rest:
Data TypeEncryptionKey Management
DatabaseAES-256AWS KMS
File storageAES-256AWS KMS
BackupsAES-256AWS KMS
LogsAES-256AWS KMS
Encryption in Transit: Key Management:

4.3 Data Masking and Anonymization

Production Data: Non-Production Environments:

4.4 Backup and Recovery

Backup Schedule:
Data TypeFrequencyRetentionLocation
DatabaseContinuous (point-in-time)35 daysCross-region
ConfigurationDaily90 daysCross-region
Audit logsReal-time7 yearsCross-region
Recovery Capabilities:

5. Access Control

5.1 Identity and Access Management

Authentication Requirements:
Access TypeAuthenticationMFA Required
Admin consoleEmail + passwordYes
API accessAPI keyN/A
InfrastructureSSO + SSH keyYes
DatabaseIAM roleYes
Password Policy:

5.2 Role-Based Access Control

Customer Roles:
RolePermissions
OwnerFull access, billing, user management
AdminFull platform access, no billing
AnalystView dashboards, reports, players
Read-onlyView-only access
Internal Roles:

5.3 Privileged Access Management

6. Monitoring and Detection

6.1 Security Monitoring

Log Collection: Log Retention:
Log TypeHot StorageCold Storage
Security logs90 days7 years
Access logs90 days2 years
Application logs30 days1 year

6.2 Threat Detection

Detection Capabilities: Alert Categories:
SeverityResponse TimeExamples
CriticalImmediateActive intrusion, data breach
High1 hourFailed auth spike, unusual access
Medium4 hoursConfiguration changes, new admin
Low24 hoursPolicy violations, failed scans

6.3 Security Information and Event Management (SIEM)

7. Incident Response

7.1 Incident Response Plan

Phases:
  1. Preparation
- Response team training

- Communication templates - Tooling and access ready

  1. Identification
- Alert triage

- Impact assessment - Classification

  1. Containment
- Short-term containment

- System isolation - Evidence preservation

  1. Eradication
- Root cause analysis

- Malware removal - Vulnerability remediation

  1. Recovery
- System restoration

- Monitoring enhancement - Gradual return to operations

  1. Lessons Learned
- Post-incident review

- Documentation - Process improvement

7.2 Incident Classification

SeverityDefinitionExample
P1 - CriticalData breach, service downCustomer data exposed
P2 - HighSignificant impactPartial service degradation
P3 - MediumLimited impactNon-critical system affected
P4 - LowMinimal impactFailed attack attempt

7.3 Communication

Internal: External:

8. Business Continuity

8.1 Disaster Recovery

Strategy: Active-passive multi-region deployment Failover Capabilities: Recovery Objectives:
MetricTargetTested
RPO< 1 hourQuarterly
RTO< 4 hoursQuarterly
MTTR< 2 hoursMonthly

8.2 High Availability

Architecture: Uptime SLA:
PlanSLAMonthly Downtime
Growth99.5%3.6 hours
Professional99.9%43.8 minutes
Enterprise99.99%4.38 minutes

8.3 Testing

9. Vendor Security

9.1 Vendor Assessment

Before engagement: Ongoing:

9.2 Key Vendors

VendorPurposeSecurity Certifications
AWSInfrastructureSOC 2, ISO 27001, PCI DSS
CloudFlareCDN, DDoSSOC 2, ISO 27001
StripePaymentsPCI DSS Level 1
DatadogMonitoringSOC 2, ISO 27001

10. Compliance

10.1 Certifications and Compliance

FrameworkStatusScope
SOC 2 Type IICompliantFull platform
ISO 27001In ProgressTarget Q2 2025
GDPRCompliantEU data processing
PCI DSSN/ANo card data stored

10.2 Audits

Internal: External:

11. Penetration Testing

11.1 Testing Program

Schedule: Scope:

11.2 Remediation

SeverityRemediation SLA
Critical24 hours
High7 days
Medium30 days
Low90 days

12. Employee Security

12.1 Background Checks

All employees undergo:

12.2 Security Training

Initial Training: Ongoing Training:

12.3 Acceptable Use

Employees must:

13. Physical Security

13.1 Office Security

13.2 Data Center Security

AWS data centers provide:

14. Security Contact

14.1 Reporting Security Issues

Security vulnerabilities:

security@sharpshield.io

Responsible Disclosure:

We appreciate security researchers who responsibly disclose vulnerabilities. We commit to:

14.2 Security Questions

For security-related inquiries:

15. Document Control

VersionDateChanges
1.0December 2025Initial release
Review Schedule: Annual (or upon significant changes) Approval: CTO, Security Team

© 2025 SharpShield. All rights reserved.